KeyCorp

Capital Markets • Talent growth in strategic areas / industry verticals of focus • Simplify and streamline our credit and portfolio management infrastructure • Expand on our differentiated capabilities (e.g., Clearwater UK(1), affordable housing, unitranche funds) Wealth Management • Increase the size of client-facing teams to further utilize differentiated platform • Digital infrastructure and capabilities, including in wealth client-facing tools and AI integration Middle Market & Commercial Payments • Add middle market bankers and payments advisors; recently added a middle market team in Atlanta, and a family office and private capital team in Kansas City • Leverage more automation and data to drive efficiency • Scale embedded banking Technology • Leveraging AI capabilities across specific end-to-end domains to modernize the client experience, streamline our client support model, and unlock frontline capacity • Building wealth digital planning & servicing tools and home equity originations capabilities • Enhancing our APIs and other client self-service tools; investing in our data & analytics and embedded banking offerings Compound our fee-based advantages Capitalizing on strong pipelines and momentum ~$1Bn Planned technology budget, up ~$200MM from 2024, positioning Key for growth & innovation Meaningful Continued Investment Opportunities Lean into our growth opportunities across Wealth Management, Payments, and Investment Banking 2026 Investment Themes +6-7% Planned increase in front-line producers(2) 10 (1) The acquisition of Clearwater Corporate Finance LLP (Clearwater UK) closed in August 2026; (2) Excludes front-line producers associated with the Clearwater Acquisition Investment Focus Areas

Capital Markets ▪ Talent growth in strategic areas / industry verticals of focus ▪ Simplify and streamline our credit and portfolio management infrastructure ▪ Expand on our differentiated capabilities (e.g., Clearwater UK(1), affordable housing, unitranche funds) Wealth Management ▪ Increase the size of client facing teams to further utilize differentiated platform ▪ Digital infrastructure and capabilities, including in wealth client-facing tools and AI integration Middle Market & Commercial Payments ▪ Add middle market bankers and payments advisors; recently added a middle market team in Atlanta, and a family office and private capital team in Kansas City ▪ Leverage more automation and data to drive efficiency ▪ Scale embedded banking Technology ▪ Wealth digital planning & servicing tools, and home equity originations capabilities ▪ Enhancing our APIs and other client self-service tools; investing in our data & analytics and embedded banking offerings Compound our fee-based advantages Capitalizing on strong pipelines and momentum ~$1Bn Planned technology budget, up ~$200MM from 2024, positioning Key for growth & innovation Meaningful Investment Opportunities Lean into our growth opportunities across Wealth Management, Payments, and Investment Banking 11 Investment Focus Areas2026 Investment Themes +6-7% Planned increase in front-line producers (1) As previously announced, KeyCorp has entered into a definitive agreement to acquire Clearwater Corporate Finance LLP (Clearwater UK). The transaction is expected to close in the second half of 2026, subject to customary closing conditions.

◦Our development and use of AI, including through third parties, exposes us to inherent risks that may adversely impact KeyCorp.

We also face risks related to the interdependence and interconnectivity of financial entities and technology systems. A technology failure, cyberattack or other security breach that significantly compromises the systems of one or more financial parties or service providers in the financial system could have a material impact on counterparties or market participants, including us. Such incidents could also lead to widespread technology outages, interruptions or other failures of operational, communication, or other systems globally and across companies and industries. Any third-party technology failure, cyberattack, or security breach could adversely affect our ability to effect transactions, service clients, or otherwise operate our business and could result in legal liability, remediation costs, regulatory action, or reputational harm. Additionally, the increasing use of third-party financial data aggregators and emerging technologies, including the use of AI, introduces new information security risks and exposure for us and for our third party service providers, and, additionally, such technologies may be used to identify vulnerabilities; such technologies have resulted in a substantial increase in the volume and sophistication of cyberattacks against financial and other institutions, including the use of generative AI to conduct more sophisticated social engineering attacks.

Our development and use of AI, including through third parties, exposes us to inherent risks that may adversely impact KeyCorp.

We use, and will increasingly use AI, including through third party vendors acting on our behalf and other counterparties, in connection with our business and operations. AI is complex and rapidly evolving and in order to compete with other banks and financial institutions effectively, we must incorporate new and emerging AI technology into our business and this may subject us to new or heightened legal, regulatory, operational, and other risk. The legal and regulatory environment relating to AI is uncertain and evolving, and any changes to applicable laws and regulations could require changes to our use of AI technology and could cause an increase in associated costs and expenses. We may also be unsuccessful in realizing the intended benefits of AI or otherwise enhancing our business or operations and our competitors may incorporate AI in their businesses or operations more quickly or more successfully than us, all of which could occur despite considerable expense and which could negatively affect our financial condition and results of operations.

The models underlying AI that we may leverage, including those developed by third party providers, may be incorrectly or inadequately designed or implemented and trained on, or otherwise use, data or algorithms that are incomplete, inadequate, misleading, biased, or otherwise flawed, or that are subject to intellectual property rights not known to us, and that ultimately produce outputs that are similarly flawed but that which we or third parties acting on our behalf rely, and any such flaw may not be easily and readily detectable. The limited transparency into the underlying complexity of AI and associated models that we rely on makes reproducing the connection between input and output, at times, difficult or impossible. If the AI that we leverage is flawed in such ways, we may make inaccurate or ineffective decisions and otherwise incur operational inefficiencies, compliance issues, competitive and reputational harm, adverse legal and regulatory actions, or other adverse impacts to our business and operations. We may not be able to sufficiently mitigate or detect any of the foregoing risks given the emerging nature of AI technology. Additionally, inappropriate or controversial data practices by third party AI developers and

their end-users could adversely affect public opinion of AI and ultimately impair acceptance of AI, including those incorporated into our business and operations.

We are also subject to the risk that disruptions to how our customers access our banking services, such as disruptions to our technology platforms (e.g., online banking websites or mobile applications) or other impacts to our branches, could harm our reputation with customers. In particular, a cybersecurity event impacting Key or our customers’ data or personal information could negatively impact our reputation and customer confidence in Key and our data security procedures. Increased model and generative AI use could expose us to liability or adverse legal or regulatory consequences and harm our reputation and the public perception of our business or the effectiveness of our security measures.

Some models we use employ methodologies based on artificial intelligence or machine learning. Compared to traditional models, these models may involve some additional complexities, such as the need for large datasets for training, the potential for algorithmic bias, and difficulty in interpreting model outputs.

and increasing sophistication of cybersecurity threats and geopolitical events, as well as the fact that threat actors frequently target technologies and systems commonly used by us and our clients. In addition, our use of emerging technology-based products and services, including cloud computing and artificial intelligence may introduce new and evolving cybersecurity risks and may create additional avenues for exploitation by threat actors. To date, Key has not experienced material disruption to our operations, or material harm to our client base, from cyberattacks. However, we have incurred, and may again incur, expenses related to the investigation of cybersecurity incidents involving third-party providers or related to the protection of our clients from identity theft as a result of such incidents. We have also incurred, and may continue to incur, expenses to enhance our systems or processes to protect against cyber or other security incidents. For more information, see “Risk Factors—We and third parties on which we rely (including their downstream service providers) may experience a cyberattack, technology failure, information system or security breach or interruption” in Item 1A. Risk Factors of this report.

Target: ~10% growth in bankers Growing Bankers Deposit Growth Growth Strategies Target: Double-digit improvements in banker productivity and cost to serve Driving Scalability and Productivity Target: High single-digit to low double-digit growth in commercial payments fees Investing in the Platform Investing in Strategic Areas to Scale the Business Loan GrowthContinuing to Build our Brand of Expertise and Service 6 • Attractive banker-friendly model • Team hire strategy, adding scale in existing markets and targeting select MSAs for expansion • Growing our own talent funnel • Continued focus on self-service adoption, AI, and automation across servicing • Increasing portfolio management capabilities and efficiency • Driving productivity in the sales funnel • Digital refresh across core platforms driving engagement and monetization • Continue to scale embedded banking • Investing in our analytics and data foundation

Capital Markets ▪ Talent growth in strategic areas / industry verticals of focus ▪ Simplify and streamline our credit and portfolio management infrastructure ▪ Expand on our differentiated capabilities (e.g., affordable housing, unitranche funds) Wealth Management ▪ Increase the size of client facing teams ▪ Digital infrastructure and capabilities, including in wealth client-facing tools Middle Market & Commercial Payments ▪ Add middle market bankers and payments advisors; recently expanded into Chicago and So. California ▪ Leverage more automation and data to drive efficiency ▪ Scale embedded banking Technology ▪ Complete migration to hybrid cloud environment; Cyber; Data and Analytics ▪ ~15 GenAI use cases currently in production that will primarily improve employee productivity and enable them to better serve our customers Positive Fee-Based Operating Leverage while continuing to invest for future growth +~$100MM increase in tech investments, focused on positioning Key for growth & innovation Meaningful Investment Opportunities Lean into our growth opportunities across Wealth Management, Payments, and Investment Banking 11 Investment Focus Areas2025 Investment Themes +10% Planned increase in front-line producers Business & Strategy

We also face risks related to the increasing interdependence and interconnectivity of financial entities and technology systems. A technology failure, cyberattack or other security breach that significantly compromises the systems of one or more financial parties or service providers in the financial system could have a material impact on counterparties or market participants, including us. Such incidents could also lead to widespread technology outages, interruptions or other failures of operational, communication, or other systems globally and across companies and industries. Any third-party technology failure, cyberattack, or security breach could adversely affect our ability to effect transactions, service clients, or otherwise operate our business and could result in legal liability, remediation costs, regulatory action, or reputational harm. Additionally, the increasing use of third-party financial data aggregators and emerging technologies, including the use of automation, artificial intelligence and robotics, introduces new information security risks and exposure for us and for our third party service providers, and, additionally, such technologies may be used to identify vulnerabilities; such technologies have resulted in a substantial increase in the volume and sophistication of cyberattacks against financial and other institutions, including the use of generative artificial intelligence to conduct more sophisticated social engineering attacks. Such security attacks can originate from a wide variety of sources/malicious actors, including, but not limited to, persons who constitute an insider threat, who are involved with organized crime, or who may be linked to terrorist organizations or hostile foreign governments. Those same parties may also attempt to fraudulently induce employees, customers, or other users of our systems to disclose sensitive information in order to gain access to our data or that of our customers or clients through social engineering, phishing, mobile phone malware and SIM card swapping, and other methods. Our security systems, and those of the third-party service providers on which we rely,

We are also subject to the risk that disruptions to how our customers access our banking services, such as disruptions to our technology platforms (e.g., online banking websites or mobile applications) or other impacts to our branches, could harm our reputation with customers. In particular, a cybersecurity event impacting Key or our customers’ data or personal information could negatively impact our reputation and customer confidence in Key and our data security procedures. Increased model and generative AI use could expose us to liability or adverse legal or regulatory consequences and harm our reputation and the public perception of our business or the effectiveness of our security measures.

Some models we use employ methodologies based on artificial intelligence (AI) or machine learning (ML). These models bring some unique complexities from those of traditional models, such as the need for large datasets for training, the potential for algorithmic bias, and the difficulty in interpreting model decisions.

and sophistication of cybersecurity threats and geopolitical events, as well as due to the expanding use of Internet and mobile banking and other technology-based products and services utilized by us and our clients, including products and services that utilize the cloud and artificial intelligence (AI), among other emerging technologies. To date, Key has not experienced material disruption to our operations, or material harm to our client base, from cyberattacks. However, we have incurred, and may again incur, expenses related to the investigation of cybersecurity incidents involving third-party providers or related to the protection of our clients from identity theft as a result of such incidents. We have also incurred, and may continue to incur, expenses to enhance our systems or processes to protect against cyber or other security incidents. For more information, see “Risk Factors—We and third parties on which we rely (including their downstream service providers) may experience a cyberattack, technology failure, information system or security breach or interruption” in Item 1A. Risk Factors of this report.

artificial intelligence and robotics, introduces new information security risks and exposure for us and for our third party service providers; such technologies could also result in increasingly sophisticated cyberattacks.

through the use of artificial intelligence. These fraudulent activities have resulted in increased fraud losses to us and

We also face risks related to the increasing interdependence and interconnectivity of financial entities and technology systems. A technology failure, cyberattack or other security breach that significantly compromises the systems of one or more financial parties or service providers in the financial system could have a material impact on counterparties or market participants, including us. Any third-party technology failure, cyberattack, or security breach could adversely affect our ability to effect transactions, service clients, or otherwise operate our business and could result in legal liability, remediation costs, regulatory action, or reputational harm. Additionally, the increasing use of third-party financial data aggregators and emerging technologies, including the use of automation, artificial intelligence and robotics, introduces new information security risks and exposure.